InventoryPath PO Inbox privacy notice

Effective: October 15, 2026. Last updated: October 31, 2026.

AvanSaber Inc. operates InventoryPath PO Inbox as a service for Shopify merchants. Read this app-specific notice alongside the AvanSaber company privacy policy. The InventoryPath website privacy supplement covers public website analytics and newsletter subscriptions.

Contact [email protected] for app privacy or security questions.

Purpose and merchant responsibilities

The merchant determines which purchase orders and buyers are processed and is responsible for an appropriate lawful basis and customer communications. We process information to import and review wholesale purchase orders, verify Shopify access and subscriptions, create merchant-approved drafts, support merchants and maintain security and compliance.

We do not sell customer data or use it for advertising, profiling, model training or consequential automated decisions.

Information the app processes

App records include shop and installation identifiers, encrypted Shopify session credentials, staff permission and approval identifiers, product identifiers, SKUs, titles, prices and explicitly saved case packs.

Buyer information includes the customer’s Shopify identifier and first and last name. For the selected customer only, we process the default shipping address: recipient, company, street, city, province, postal code and country.

Purchase-order records include the PO reference, uploaded text, reviewed lines, prices, quantities, shipping charge and current calculated total, native Shopify draft reference and outcome, and app usage.

Customer Email and Phone are not requested or queried. Uploaded CSV can contain incidental personal information entered by the merchant; avoid unnecessary information. There is no app-operated customer email, SMTP, OCR or AI service in this release.

Access and protection

Only authorised Shopify users with current required permissions may use app data. Setup and privacy-response completion are owner-only.

Names, addresses, source and review content, and session credentials are encrypted at the application layer. HTTPS protects external traffic, and database and runtime listeners are isolated to loopback. Personal-data access records contain timestamps, fixed purposes and keyed actor or resource hashes, rather than raw names, addresses, CSV or tokens. Operator access is limited to authorised maintainers.

These controls are not a third-party certification or a guarantee of absolute security.

Providers and international processing

Shopify supplies the platform, authentication, customer and product access, draft-order operations and app billing. Amazon Web Services hosts the application and database server in US West, Oregon. Cloudflare provides DNS, edge HTTPS and security, and RunCloud manages the application host. Authorised operators may access necessary information for support and security.

This processing can take place in the United States, including when a merchant or customer is elsewhere. The company privacy policy describes general international-processing and rights information alongside this app-specific notice.

Public website cookies and analytics follow InventoryPath’s existing consent-aware website policy. The embedded app uses essential Shopify authentication and has no app marketing trackers.

Retention and deletion

Uninstall revokes app access and removes retained buyer, source and review data through lifecycle cleanup. Native drafts already created in Shopify remain under the merchant’s control.

Nonreversible keyed duplicate-attempt fences and usage counts contain no original PO, name or address. Known attempts retain fences for 90 days; unresolved attempts keep a fence until safely resolved. Usage history expires 90 days after its window ends. These safeguards do not provide access to erased content.

Customer requests and contact

Merchants handle customer access, export, correction and erasure requests through their Shopify processes, supported by mandatory app privacy webhooks and an owner response queue. Downloading a response does not automatically send it to a customer. The owner reviews and delivers the complete response through an authorised channel before marking the request completed.

Customers should contact their merchant about their information. The company privacy policy describes general privacy rights and the request process. Contact [email protected] about app privacy or security, identifying the store and issue without sending unnecessary customer data or credentials.

We update this notice when processing changes and provide meaningful notice where required.

AvanSaber Inc. operates InventoryPath PO Inbox.

App terms · Support · Merchant guide

Optional merchant setup tips

Optional setup tips are available. The full guide and core app work without email enrollment. Only the authenticated store owner can separately opt in and verify an eligible individual inbox. Buyers, suppliers and reps are not enrolled by receiving operational messages, and Shopify customer emails are not imported into marketing lists for this feature.

If the store owner requests optional setup tips, the optional service processes the deliberately supplied merchant help inbox, verification status, owner-authorised purpose/version/timestamp, preference and withdrawal evidence, confirmed store time zone, installation context and coarse app progress. Onboarding adds no Shopify customer Email access or new Shopify scope.

The optional service is hosted on existing AvanSaber-controlled infrastructure, separately from core app databases and services. It receives a minimal read-only view of readiness, qualifying outcomes and known blockers. It does not receive Shopify access tokens or underlying order/customer details, artwork, supplier files, PO rows, invoices, assignments, commission values or rep credentials.

Zoho Campaigns delivers optional educational setup tips. Zoho CPaaS/ZeptoMail delivers requested setup-tip verification codes under a separate transactional purpose. These services receive the supplied help inbox, generic app help content and the delivery or subscription identifiers needed for that purpose. They do not receive Shopify access tokens, purchase-order rows, order contents or shipping addresses from the optional setup-tip service. Brevo is retained only where needed for previous withdrawals, late-event handling and historical message/resource cleanup; it is not selected to send new tips for this app. Migration never reenrolls withdrawn or completed sequences.

The apps share a sending connection, but have separate setup-tip topics and app-specific preferences. Current installation, consent, completion and withdrawal checks still apply before educational dispatch. Stopping one app’s tips does not subscribe, unsubscribe or enroll the inbox in unrelated brand newsletters. The portfolio stop-all control and provider unsubscribe/suppression settings also apply.

Email providers process delivery and subscription events. Educational email may include provider-managed open or link tracking. Opens and clicks do not determine whether setup is complete. This feature adds no tracking to the embedded app or private purchase-order content. Requested verification uses a separate transactional purpose; the Zoho CPaaS verification route has open and click tracking disabled.

Keyed pseudonymous inbox indexes and minimal dispatch reservations enforce shared portfolio sending limits and stop-all preferences. These indexes are not anonymous. App credentials and domain databases remain separate; this shared boundary does not let one app browse another app’s domain records. Requested verification and security messages have a separate purpose and do not consume the educational-email allowance.

Incomplete verification preferences and challenges are cleaned within thirty days. Codes expire after ten minutes and are cleared after expiry or attempt limits. Detailed dispatch evidence is normally retained for up to ninety days after the program window; pending external cleanup identifiers remain until resolved. Consent/preference evidence may remain for up to twelve months after the window or withdrawal. Minimal pseudonymous suppression and closed-program records remain to prevent unintended re-enrollment after reinstall or recovery. Restored optional databases are quarantined and current withdrawals and installation state must be reconciled before sending resumes.

We remove app-owned mailing-list memberships and delivery resources when safe, preserve shared profiles and suppression records, and arrange additional provider erasure when required. Historical delivery records and provider backups are not erased instantly. Zoho CPaaS documents sixty-day email-log retention by default; stored message content depends on the account’s content-saving settings. Do not interpret expiration of a login code as immediate deletion of a provider delivery log. Brevo sent campaigns may be archived where deletion is unavailable; archival is not deletion of historical delivery records.

Uninstall or data erasure stops optional sending once detected, clears current inbox/challenge/guide data and queues provider cleanup. Before education dispatch, current authorisation and installation are checked again. Delayed lifecycle or provider queues can leave a message in flight; it cannot always be recalled immediately. Core app operations are independent of optional-service availability.

The owner may stop this app’s tips or all InventoryPath app setup tips for the verified inbox. Provider unsubscribe and account-wide suppression also apply. No contacts are imported automatically. Choosing not to enroll does not limit the app, and operational recipient verification does not enroll buyers, suppliers or reps. Optional setup-tip sender and Reply-To are Inventory App at [email protected]. Existing product support and privacy requests remain with [email protected]. Both brands belong to AvanSaber Inc.

Use an individual inbox without a + tag for optional tips. Zoho Campaigns rejects tagged addresses and some role addresses such as support@, info@ and admin@. The app explains this before requesting a verification code. Enter an eligible individual inbox yourself; operational email can still use supported role addresses.

The postal footer for optional tips is AvanSaber Inc., 1050 Lakes Drive, Suite #225, West Covina, CA 91790, United States.